38 lines
2.2 KiB
Bash
Executable file
38 lines
2.2 KiB
Bash
Executable file
#!/bin/bash
|
|
# CUST-WP-0073 r4 — run as root inside the NEW distro only:
|
|
# wsl.exe -d custodian-agents -u root -- bash /path/guest-setup.sh --i-am-attended
|
|
set -euo pipefail
|
|
[ "${1:-}" = --i-am-attended ] || { echo 'REFUSED: attended flag missing' >&2; exit 78; }
|
|
test "$(id -u)" = 0
|
|
test "${WSL_DISTRO_NAME:-}" = custodian-agents
|
|
test ! -e /etc/custodian-agents/staged
|
|
! getent passwd custodian-agt >/dev/null
|
|
here="$(cd "$(dirname "$0")" && pwd)"
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update -q
|
|
apt-get install -y -q openssh-server git curl ca-certificates python3 python3-venv jq ripgrep unzip
|
|
systemctl disable ssh.service ssh.socket 2>/dev/null || true
|
|
# Ubuntu's default account (uid 1000) may not exist in the rootfs; agent gets a fixed uid.
|
|
uid=1001; while getent passwd $uid >/dev/null || getent group $uid >/dev/null; do uid=$((uid+1)); done
|
|
groupadd --gid $uid custodian-agt
|
|
useradd --uid $uid --gid $uid --create-home --shell /bin/bash custodian-agt
|
|
passwd --lock custodian-agt
|
|
passwd --lock root
|
|
chmod 0700 /home/custodian-agt
|
|
# No sudo: Ubuntu's sudo group grants it, so make sure the agent is never in it.
|
|
! id -nG custodian-agt | tr ' ' '\n' | grep -qx -e sudo -e admin -e adm -e docker
|
|
install -d -o custodian-agt -g custodian-agt -m 0700 /home/custodian-agt/work /home/custodian-agt/.kube /home/custodian-agt/.ssh
|
|
install -o root -g root -m 0644 "$here/wsl.conf" /etc/wsl.conf
|
|
install -d -o root -g root -m 0755 /etc/ssh/authorized_keys
|
|
install -o root -g root -m 0644 /dev/null /etc/ssh/authorized_keys/custodian-agt
|
|
install -o root -g root -m 0600 "$here/sshd_config" /etc/ssh/sshd_config.d/00-custodian-agents.conf
|
|
# Drop-in replaces nothing in the stock config except via first-match; stock Port 22 is removed.
|
|
sed -i -e 's/^#\?Port .*/# Port set in sshd_config.d/' /etc/ssh/sshd_config
|
|
install -o root -g root -m 0644 "$here/custodian-agents-sshd.service" /etc/systemd/system/custodian-agents-sshd.service
|
|
ssh-keygen -A >/dev/null
|
|
install -d -m 0755 /run/sshd
|
|
/usr/sbin/sshd -t
|
|
systemctl enable custodian-agents-sshd.service
|
|
install -d -o root -g root -m 0700 /etc/custodian-agents
|
|
date -u +%FT%TZ > /etc/custodian-agents/staged
|
|
echo "staged custodian-agt uid=$uid; restart distro (wsl.exe --terminate custodian-agents) to apply wsl.conf"
|